Affected by GO-2024-3077 and 4 other vulnerabilities

GO-2024-3077: Capsule tenant owner with "patch namespace" permission can hijack system namespaces in github.com/projectcapsule/capsule

GO-2026-5043: Capsule Namespace Hijacking via subresource in github.com/projectcapsule/capsule

GO-2026-5584: Capsule TenantResource RawItems Cluster-Scoped Resource Creation Vulnerability in github.com/projectcapsule/capsule

GO-2026-6155: Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests in github.com/projectcapsule/capsule

GO-2026-6520: Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement in github.com/projectcapsule/capsule

utils

package

v0.10.6 Latest Latest Go to latest Published: Aug 20, 2025 License: Apache-2.0 Imports: 15 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/projectcapsule/capsule

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
func BuildNodeSelector(tnt *capsulev1beta2.Tenant, nsAnnotations map[string]string) map[string]string
func GetOwnersWithKinds(tenant *capsulev1beta2.Tenant) (owners []string)
func GetTypeLabel(t runtime.Object) (label string, err error)
func IsNamespaceSelectedBySelector(ns *corev1.Namespace, selector *metav1.LabelSelector) (bool, error)
func IsTenantOwnerReference(or metav1.OwnerReference) bool
func IsUnsupportedAPI(err error) bool
func PoolResourceQuotaName(quota *capsulev1beta2.ResourcePool) string
type UserGroupList
- func NewUserGroupList(groups []string) UserGroupList

Constants ¶

View Source

const (
	CordonedLabel = "projectcapsule.dev/cordoned"
)

View Source

const (
	NodeSelectorAnnotation = "scheduler.alpha.kubernetes.io/node-selector"
)

View Source

const (
	ObjectReferenceTenantKind = "Tenant"
)

Variables ¶

This section is empty.

Functions ¶

func BuildNodeSelector ¶

func BuildNodeSelector(tnt *capsulev1beta2.Tenant, nsAnnotations map[string]string) map[string]string

func GetOwnersWithKinds ¶

func GetOwnersWithKinds(tenant *capsulev1beta2.Tenant) (owners []string)

func GetTypeLabel ¶

func GetTypeLabel(t runtime.Object) (label string, err error)

func IsNamespaceSelectedBySelector ¶ added in v0.9.0

func IsNamespaceSelectedBySelector(ns *corev1.Namespace, selector *metav1.LabelSelector) (bool, error)

func IsTenantOwnerReference ¶ added in v0.7.0

func IsTenantOwnerReference(or metav1.OwnerReference) bool

func IsUnsupportedAPI ¶

func IsUnsupportedAPI(err error) bool

func PoolResourceQuotaName ¶ added in v0.10.0

func PoolResourceQuotaName(quota *capsulev1beta2.ResourcePool) string

Types ¶

type UserGroupList ¶

type UserGroupList interface {
	Find(needle string) (found bool)
}

func NewUserGroupList ¶

func NewUserGroupList(groups []string) UserGroupList

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL